Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.4
CVE-2026-105249: vgmstream TXTP file handling can crash locally
CVE-2026-105249 · published 14 days ago
Summary
The vgmstream program’s TXTP file parser may misuse memory, allowing a local user to cause the application to stop working unexpectedly. This risk occurs when specially crafted TXTP files are processed. Apply the provided patch to correct the issue and prevent crashes.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| – | vgmstream | r2117 |
Original advisory text
vgmstream TXTP File txtp_process.c make_group_random use after free
A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the component TXTP File Handler. This manipulation causes use after free. The attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024. It is recommended to apply a patch to fix this issue.
References
- https://github.com/vgmstream/vgmstream/
- https://vuldb.com/cve/CVE-2026-105249
- https://vuldb.com/submit/976279
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-1052... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-105249 Vendor Advisory
- https://vuldb.com/vuln/413456
- https://github.com/vgmstream/vgmstream/issues/1998
- https://vuldb.com/vuln/413456/cti
- https://github.com/vgmstream/vgmstream/commit/ae37662ad626254ddd96ad69ac263792d7...
- https://github.com/vgmstream/vgmstream/pull/2008
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-119Buffer Overflow
CWE-416Use After Free
Timeline
Published5 Oct 2026
Updated9 Oct 2026
First seen5 Oct 2026
Track software like this
Free during beta